if local_assigns[:include_access_tokens]
  # Withhold the full-scope token from callers who authenticated with a
  # read-only token — otherwise GET /api/v1/profile would let a read-only
  # holder lift the full token and bypass the scope gate entirely.
  json.access_token resource.access_token&.token unless @access_token&.scope == 'read_only'
  json.read_only_access_token resource.read_only_access_token&.token
end
json.account_id resource.active_account_user&.account_id
json.available_name resource.available_name
json.avatar_url resource.avatar_url
json.confirmed resource.confirmed?
json.display_name resource.display_name
json.message_signature resource.message_signature
json.email resource.email
json.hmac_identifier resource.hmac_identifier if GlobalConfig.get('CHATWOOT_INBOX_HMAC_KEY')['CHATWOOT_INBOX_HMAC_KEY'].present?
json.id resource.id
json.inviter_id resource.active_account_user&.inviter_id
json.name resource.name
json.provider resource.provider
# Withhold the pubsub token from read-only token holders — it authenticates
# RoomChannel without any API-token scope check, letting a caller write presence
# and stream live account events (a write the read-only scope must not grant).
json.pubsub_token resource.pubsub_token unless @access_token&.scope == 'read_only'
json.custom_attributes resource.custom_attributes if resource.custom_attributes.present?
json.role resource.active_account_user&.role
json.ui_settings resource.ui_settings
json.uid resource.uid
json.type resource.type
json.accounts do
  json.array! resource.account_users do |account_user|
    json.id account_user.account_id
    json.name account_user.account.name
    json.status account_user.account.status
    json.onboarding_step account_user.account.onboarding_step
    json.active_at account_user.active_at
    json.role account_user.role
    json.permissions account_user.permissions
    # the actual availability user has configured
    json.availability account_user.availability
    # availability derived from presence
    json.availability_status account_user.availability_status
    json.auto_offline account_user.auto_offline
    json.partial! 'api/v1/models/account_user', account_user: account_user if ChatwootApp.enterprise?
  end
end